A quote received by email, a QR code tucked at the bottom of the page next to the deposit amount, and a gesture that has become almost automatic: pull out your phone, scan, pay. That’s exactly what I did a few weeks ago, right at the start of renovation work, without asking a single question. The document bore the craftsman’s header, the logo, the VAT number—everything seemed coherent. Yet this experience taught me a lesson I won’t forget anytime soon: A QR code on a quote is by no means, in itself, a guarantee of security. And the worst part is that no one takes the time to explain to individuals what should be checked before validating this type of payment. We end up trusting a simple square of pixels, not knowing that it could conceal a completely different beneficiary than the one printed on the page.
- A fraudulent QR code looks visually identical to a legitimate QR code; there are no outward signs that let you distinguish them with the naked eye.
- A simple call to the craftsman, using their usual number, to confirm the IBAN and the amount is enough to foil the fraud.
- Fraudsters mainly target deposits of a few hundred euros—not high enough to raise suspicion, not so low as to be ignored.
- The QR code, this detail that changes everything on an artisan’s quote
- Why fake IBANs circulate more easily than we think
- Checks that take thirty seconds and prevent a theft of several thousand euros
- The golden rule to adopt before every deposit paid to a craftsman
The QR code, this detail that changes everything on an artisan’s quote
At first glance, the QR code seems to save time. No more copying a long IBAN or hunting down a transfer reference; you just scan and the banking app suggests the payment directly. This simplicity, appealing on paper, is precisely what makes it risky. A QR code is nothing more than an encoded image containing information, namely banking details and sometimes a prefilled amount. There is no guarantee that these data truly correspond to the company that issued the quote. Unlike a business card printed by the professional themselves, this tiny square can be generated, copied, or substituted by anyone who has had access to the document, whether during its email transfer or its sharing via a messaging app.
The problem is that visually, a fraudulent QR code and a legitimate QR code are indistinguishable. No external sign lets you tell them apart with the naked eye. It is this invisibility of fraud that explains why so many individuals are caught out without realizing it for days, sometimes weeks.
Why fake IBANs circulate more easily than we think
Fraud involving fake bank details isn’t new, but it has become significantly modernized with the spread of digital quotes. In the past, you had to intercept a paper letter to substitute a bank identity record. Today, it only takes access to a compromised email inbox, a shared computer, or poorly secured cloud storage to intercept a PDF, tweak it slightly, and resend it with a new embedded QR code. The victim only sees the usual layout, the artisan’s name, their SIRET number, and suspects nothing.
This type of scam also benefits from a well-known human factor: the trust placed in a professional with whom one has already interacted several times. We’ve met the craftsman at home, discussed the project, signed a paper or digital quote; it then seems almost absurd to doubt a simple payment link sent afterward. It is precisely this trust-based relationship that scammers exploit, betting on the idea that no one will bother to call back to verify a deposit of a few hundred euros. Yet it is precisely these amounts, not too high to arouse suspicion and not too low to be ignored, that are most often targeted.
Checks that take thirty seconds and prevent a theft of several thousand euros
The good news is that protecting yourself from this kind of trap requires neither technical expertise nor special equipment. A few quick habits are enough to drastically reduce the risk. Here are the essential checks to perform before approving a down payment:
- Compare the name of the beneficiary shown when scanning with the exact name of the company listed on the original quote
- Call the craftsman on their usual number, the one already used before the project began, to verify the IBAN and the requested amount verbally
- Verify that the sender’s email address for the quote matches the known professional domain, with no spelling errors or suspicious characters
- Be wary of any sudden urgency, such as a down payment to be settled “before tonight” to unlock the work
- Prefer a traditional manually entered transfer over a link or a QR code when in doubt
All of these actions add up to about thirty seconds. A simple phone call is often enough to halt any fraud attempt, because a counterfeit bank details never withstand direct verbal confirmation with the genuine professional. It is precisely this step that most victims skip, out of courtesy or lack of time, even though it is the only truly effective safeguard.
The golden rule to adopt before every deposit paid to a craftsman
After this narrowly avoided mishap, a rule has become obvious: the QR code on a quote or invoice is never, by itself, a legitimate payment method. It should be regarded only as a convenient shortcut, never as proof of reliability. Only the bank details confirmed verbally, directly with the craftsman and through a channel of communication already established before the project, can truly be trusted.
This precaution applies to all amounts, even the smallest, because scammers rely precisely on the sense of security that a tiny sum provides. Adopting this systematic reflex costs nothing, does not really slow down the start of work, and offers lasting protection against unwelcome banking surprises. In a context where professional documents circulate almost exclusively through digital channels, this vigilance becomes as essential a skill as checking a craftsman’s reviews or insurance before signing.
This kind of experience repeatedly reminds us that technology makes daily tasks easier but never substitutes common sense. A QR code remains a tool, not a guarantee. So, next time a quote lands in your inbox with a small square to scan at the bottom of the page, will you make the reflex to pick up the phone before validating the payment?
